Orangehrm CVE-2024-36428

HIGH

SQL Injection (CWE-89)

2024-05-27 cve@mitre.org

8.1

CVSS 3.1 · Vendor: mitre

Share

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

1

CVE Published

May 27, 2024 - 23:15 cve.org

HIGH 8.1

DescriptionCVE.org

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

AnalysisAI

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection. Affected products include: Orangehrm.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Orangehrm

View all

CVE-2019-12839 HIGH This Week POC

In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath pa

CVE-2012-1506 MEDIUM This Month POC

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows r

CVE-2012-5367 MEDIUM This Month POC

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbi

CVE-2012-1507 MEDIUM This Month POC

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary w

CVE-2022-28985 MEDIUM This Month POC

A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to e

CVE-2022-27110 MEDIUM This Month POC

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint. Rated medium severity

CVE-2022-27109 MEDIUM This Month POC

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability. Rated medium severity (CVSS 5.4), this vu

CVE-2022-27107 MEDIUM This Month POC

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo

CVE-2025-66224 CRITICAL Act Now

OrangeHRM is a comprehensive human resource management (HRM) system. Rated critical severity (CVSS 9.0), this vulnerabil

CVE-2025-66289 HIGH This Week

OrangeHRM is a comprehensive human resource management (HRM) system. Rated high severity (CVSS 8.7), this vulnerability

CVE-2025-66225 HIGH This Week

OrangeHRM is a comprehensive human resource management (HRM) system. Rated high severity (CVSS 8.7), this vulnerability

CVE-2014-100021 MEDIUM This Month POC

Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2015-7297 HIGH POC

Same technique SQLi

View all

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2013-0333 HIGH POC

CVE-2015-7297 HIGH POC

Share

CVE-2024-36428 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy